       (if match
         (allow? match)
         false))))
-


(def Entry
  "An authorization entry matching a network or a domain"
  {
    :auth-type auth-type
    :type (schema/enum :allow-all :ip :domain :opaque :regex :dynamic)
    :qualifier (schema/enum :exact :inexact)
    :length (schema/maybe schema/Int)
    :pattern schema/Any
    })

(def ACL
  "An ordered list of authorization Entry"

   * exact wins other inexact
   * ip wins other domain
   * larger pattern length wins
   * order patterns"
  [a :- Entry
   b :- Entry]
  (or-zero
